Seven WordPress plugins were compromised without touching a line of their code
2026-08-13Security
Attackers took credentials for a DigitalOcean Spaces bucket that BdThemes' promotional banner fetches JSON from. The plugin source stayed clean. Every admin page load ran the attacker's JavaScript anyway.